ChainGPT Dashboard
A single localhost web UI that gives a glance-at-it view of the marketplace: which plugin/MCP/marketplace version is installed, what skills are available, recent agent-wallet activity, environment-variable health, and pointers to docs + changelog.
Read-only. No signing flows are proxied through the browser. The dashboard intentionally cannot move funds — that stays in MCP tool calls with explicit user confirmation.
How to open
The fastest path is the slash command:
/chaingpt:dashboard
That calls the underlying MCP tool, prints a URL and a one-time admin token, and asks if you want to open the URL in your browser.
You can also call the tool directly:
> Use chaingpt_dashboard_serve to start the dashboard on port 8788
Panels
| Panel |
What it shows |
Source |
| Overview |
Plugin / MCP / marketplace versions; skill count; agent-wallet init state; docs link |
.claude-plugin/*.json, mcp-server/package.json, ~/.chaingpt-mcp/agent-wallet/keystore.json |
| Wallet |
Agent EOA address (copy button); policy summary (kill switch, unrestricted mode, allowed chains, allowed/blocked address counts, max tx value, max gas, memo requirement, policy digest); tracked-token + custom-chain counts; signed-tx count; CTA to launch the full Wallet Admin UI (port 8787) for editing. Read-only — reads the public address from the keystore, never decrypts. |
~/.chaingpt-mcp/agent-wallet/{keystore,policy,tracked-tokens,custom-chains}.json |
| Skills |
One card per skill in skills/ with name + description from its SKILL.md frontmatter |
skills/*/SKILL.md |
| Activity |
Most recent signed transactions (newest first) |
~/.chaingpt-mcp/agent-wallet/activity.jsonl (empty if you haven't signed yet) |
| Health |
Presence (not value) of CHAINGPT_API_KEY, agent-wallet passphrase, Etherscan/Moralis/GoPlus keys; Node runtime; key paths |
process.env, filesystem |
| About |
Plugin info + top of CHANGELOG.md |
.claude-plugin/plugin.json, CHANGELOG.md |
Security model
- Bind:
127.0.0.1 only — never 0.0.0.0. Cross-host access requires an SSH tunnel.
- Admin token: 48 hex chars / 192 bits, written to
~/.chaingpt-mcp/dashboard/.admin-token with 0600 perms. Rotated on every chaingpt_dashboard_serve call.
- Sessions: HttpOnly cookie
cg_dash_sid, 1-hour sliding TTL, in-memory only (no persistence across restarts).
- CSRF: All state-changing requests checked against
Origin (or Referer) — must equal http://127.0.0.1:<port> / http://localhost:<port>.
- No secrets in the browser. API keys never leave the Node process; the dashboard reports presence flags only.
Coexistence with the agent-wallet UI
The dashboard and chaingpt_agent_wallet_serve_ui run as separate servers on separate ports (8788 vs. 8787) with independent admin tokens. They share no auth state. Both can run simultaneously.
Environment variables (optional)
| Var |
What |
CHAINGPT_DASHBOARD_DIR |
Override the dashboard state dir. Default: ~/.chaingpt-mcp/dashboard/ |
Troubleshooting
- Login screen rejects the token: the token rotates each invocation. Re-run
/chaingpt:dashboard and use the freshly printed token.
- Port in use: pass a different port:
chaingpt_dashboard_serve({ port: 9999 }).
- 403 Origin check failed: you're hitting the URL from somewhere other than
127.0.0.1:<port> / localhost:<port>. Open the URL exactly as printed.
1---2name: dashboard3description: Open the ChainGPT marketplace dashboard — a localhost web UI with six read-only panels (Overview, Wallet, Skills, Activity, Health, About). Bind 127.0.0.1 only, admin-token auth, same-origin CSRF defense. Triggers: dashboard, open the dashboard, ChainGPT dashboard, marketplace dashboard, show me the dashboard, web UI, control panel, skills overview, agent wallet panel, env check, plugin health.4---56# ChainGPT Dashboard78A single localhost web UI that gives a glance-at-it view of the marketplace: which plugin/MCP/marketplace version is installed, what skills are available, recent agent-wallet activity, environment-variable health, and pointers to docs + changelog.910**Read-only.** No signing flows are proxied through the browser. The dashboard intentionally cannot move funds — that stays in MCP tool calls with explicit user confirmation.1112## How to open1314The fastest path is the slash command:1516```17/chaingpt:dashboard18```1920That calls the underlying MCP tool, prints a URL and a one-time admin token, and asks if you want to open the URL in your browser.2122You can also call the tool directly:2324```25> Use chaingpt_dashboard_serve to start the dashboard on port 878826```2728## Panels2930| Panel | What it shows | Source |31|---|---|---|32| Overview | Plugin / MCP / marketplace versions; skill count; agent-wallet init state; docs link | `.claude-plugin/*.json`, `mcp-server/package.json`, `~/.chaingpt-mcp/agent-wallet/keystore.json` |33| Wallet | Agent EOA address (copy button); policy summary (kill switch, unrestricted mode, allowed chains, allowed/blocked address counts, max tx value, max gas, memo requirement, policy digest); tracked-token + custom-chain counts; signed-tx count; CTA to launch the full Wallet Admin UI (port 8787) for editing. Read-only — reads the public address from the keystore, never decrypts. | `~/.chaingpt-mcp/agent-wallet/{keystore,policy,tracked-tokens,custom-chains}.json` |34| Skills | One card per skill in `skills/` with name + description from its SKILL.md frontmatter | `skills/*/SKILL.md` |35| Activity | Most recent signed transactions (newest first) | `~/.chaingpt-mcp/agent-wallet/activity.jsonl` (empty if you haven't signed yet) |36| Health | Presence (not value) of CHAINGPT_API_KEY, agent-wallet passphrase, Etherscan/Moralis/GoPlus keys; Node runtime; key paths | `process.env`, filesystem |37| About | Plugin info + top of `CHANGELOG.md` | `.claude-plugin/plugin.json`, `CHANGELOG.md` |3839## Security model4041- **Bind:** `127.0.0.1` only — never `0.0.0.0`. Cross-host access requires an SSH tunnel.42- **Admin token:** 48 hex chars / 192 bits, written to `~/.chaingpt-mcp/dashboard/.admin-token` with `0600` perms. Rotated on every `chaingpt_dashboard_serve` call.43- **Sessions:** HttpOnly cookie `cg_dash_sid`, 1-hour sliding TTL, in-memory only (no persistence across restarts).44- **CSRF:** All state-changing requests checked against `Origin` (or `Referer`) — must equal `http://127.0.0.1:<port>` / `http://localhost:<port>`.45- **No secrets in the browser.** API keys never leave the Node process; the dashboard reports presence flags only.4647## Coexistence with the agent-wallet UI4849The dashboard and `chaingpt_agent_wallet_serve_ui` run as separate servers on separate ports (8788 vs. 8787) with independent admin tokens. They share no auth state. Both can run simultaneously.5051## Environment variables (optional)5253| Var | What |54|---|---|55| `CHAINGPT_DASHBOARD_DIR` | Override the dashboard state dir. Default: `~/.chaingpt-mcp/dashboard/` |5657## Troubleshooting5859- **Login screen rejects the token:** the token rotates each invocation. Re-run `/chaingpt:dashboard` and use the freshly printed token.60- **Port in use:** pass a different port: `chaingpt_dashboard_serve({ port: 9999 })`.61- **403 Origin check failed:** you're hitting the URL from somewhere other than `127.0.0.1:<port>` / `localhost:<port>`. Open the URL exactly as printed.
jiayaoqijia